CVE-2026-115930

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.

• CWE-295

• https://www.mongodb.com/docs/mongodb-shell/changelog/

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115910Python Social Auth is a social authentication and registrati…6.8
• CVE-2026-115911vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-115912vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-115913vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-11592The Email Subscribers & Newsletters – Email Marketing, Post …4.3
• CVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime th…6.8
• CVE-2026-115931Postiz lets a signed-in user ask the backend to run a functi…9.9
• CVE-2026-115932When a post is published, Postiz treats a media path that is…9.6
• CVE-2026-115933Postiz signs its session, invitation and password reset toke…9.9
• CVE-2026-115935The app/process-api-response-headers action accepts fake Cra…8.8
• CVE-2026-115937The Mollie webhook endpoint accepts two independent, attacke…7.5
• CVE-2026-115938Craft CMS allows any authenticated control panel user to sub…8.8